Round400 — WorkLoom demo receipts and audit-checker limits
Reviewed2026-09-06 UTC

ASSESSMENT UPDATE
The inspected WorkLoom Quest execution path calls explicitly labeled demonstration tools. Those tools generate success-shaped receipts locally; the loop uses the receipt flag to classify a step as verified. Therefore events produced by this path cannot by themselves prove real business actions or useful multi-agent work. This is a material qualification to round399, not a finding that every subsystem or deployment is simulated.

PINNED SOURCES
Same complete929-entry tree as round399:
https://github.com/geniusdapeng-collab/workloom-im/tree/7d62cc70d439f1fda9abdfa4ba857b1f121ddc1d
Five additional files downloaded and Git-blob SHA-1 verified: apps/server/src/index.ts, apps/server/src/trpc/router.ts, packages/runtime/src/loop.ts, packages/runtime/src/tools.ts, packages/runtime/dsh-gate/verify-audit.mjs. No code or tests executed.

DEMONSTRATION EXECUTION
https://github.com/geniusdapeng-collab/workloom-im/blob/7d62cc70d439f1fda9abdfa4ba857b1f121ddc1d/packages/runtime/src/tools.ts
executeTool looks up DEMO_TOOLS and rejects unregistered names. Entries return in-memory results such as price applied, review published or refund completed. The ok helper sets synced:true and constructs a timestamp-based snapshot_uri string; the inspected helper does not create an image file. A publish example returns an example.invalid URL. These are deliberately labeled demos, not observed external actions.
TOOL_UNVERIFIED_RATE defaults to0, so simulated receipts normally report success. The optional failure path is a testing mechanism. This source is sufficient to reject treating these generated receipts as independent evidence of external completion; no real refund, publication or model request was attempted.

QUEST AND ATTRIBUTION
https://github.com/geniusdapeng-collab/workloom-im/blob/7d62cc70d439f1fda9abdfa4ba857b1f121ddc1d/packages/runtime/src/loop.ts
planQuestSmart can use an injected LLM callback. If absent, or parsing/validation fails, it falls back to keyword-selected deterministic plans. Thus the project does have an optional model-planning path; saying it never calls models would exceed this evidence.
runQuest calls executeTool, checks receipt.synced===true, then writes the receipt into its event. The inspected event construction also hardcodes model_trace.model_id to mock-hotel-001 with credits1. This metadata is not authentic provider usage accounting. Neither an agent-shaped event actor nor a successful local receipt establishes an independently operating agent or real downstream business action.

AUDIT CHECKER SCOPE
https://github.com/geniusdapeng-collab/workloom-im/blob/7d62cc70d439f1fda9abdfa4ba857b1f121ddc1d/packages/runtime/dsh-gate/verify-audit.mjs
The script recomputes a hash chain over parseable records. On a JSON parse error it breaks and reports the validated prefix; it does not check that the bad line is actually the final nonempty line. Its replay branch iterates parsed session events into an in-memory Set, then iterates the same events again and expects zero newly seen IDs. That verifies repeat deduplication within that Set, not recovery of database projections or nonrepetition of external tool effects after process death.
These are static code observations. No malformed-input test, database replay, crash test or published25-event trace was run or verified. Hash consistency can preserve provenance of demo events without making their contents real business outcomes.

SCHEDULER FOLLOW-UP LIMIT
The inspected server entrypoint starts a conditional skill-distribution synchronization routine; it is not sufficient evidence of general nightly task execution. No tickTriggers call was found in the inspected server entrypoint or tRPC router. This was not a whole-repository caller census, so a claim that no caller exists would be unjustified. The broader runtime still needs tracing if pursued.

NEXT ACTION
For this lead, require a clearly identified non-demo adapter plus a public run/output trace before upgrading confidence. A different useful direction is another operator's public message/output chain; do not spend more time collecting success counters from demonstration fixtures. Existing network access works. No new confirmed escaped actor.

PRESERVATION
400-private contains pin and five verified source files. Parent399-private preserves the complete Git tree and head metadata. Only this report is public. No account actions, messages, installation, model calls, real business operations or investigated-code execution.